706b15d942b3e4a24efaa68152af472cbadff40a97ad171d007d81dbd79a990e

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9835089c9bd21c5c36fbc0de5df56ea_JaffaCakes118.html
Size

460KB
MD5

c9835089c9bd21c5c36fbc0de5df56ea
SHA1

f8864ef401b8eb7661b0d4e073fc5bbc7990e445
SHA256

706b15d942b3e4a24efaa68152af472cbadff40a97ad171d007d81dbd79a990e
SHA512

1a13111a7a2dd353aab1258fa5b39a8e5f59e80f4a9a68e7f7fb02791d9a56771afe9bc0b786ecc03346a31cd9703f3911590f70cdb6c9c4ab2bf75d77888f10
SSDEEP

6144:S6sMYod+X3oI+YKQEsMYod+X3oI+YmsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3i5d+X3+5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
3088	msedge.exe
3088	msedge.exe
3816	identity_helper.exe
3816	identity_helper.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2768	3088	msedge.exe	84
PID 3088 wrote to memory of 2768	3088	msedge.exe	84
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 1796	3088	msedge.exe	85
PID 3088 wrote to memory of 2992	3088	msedge.exe	86
PID 3088 wrote to memory of 2992	3088	msedge.exe	86
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87
PID 3088 wrote to memory of 232	3088	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c9835089c9bd21c5c36fbc0de5df56ea_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f57d46f8,0x7ff9f57d4708,0x7ff9f57d4718
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16485620799124104469,5576727537736633740,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
058259eb5b9922e065afec3617c3b8fb

SHA1
f205b5ae8ec8b43a63ec175fd95bdf52b555f817

SHA256
b1bdf31d7d4a439ec4f0f425e2fb0deb74469637d7daa3caec31d4a5995fb3db

SHA512
1a134ded3eb3f8f107866ba03c73ce6cf0cc2817682e40ca81bee687fe8a33a28f1bfbdef3a9b7514dfae5a340ded8d2307abeaced269baed62f79476a74f58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a78813ae8b3635aacbf4a790ee7cb7e

SHA1
5fccf9700827700eeafbebc56b889bbb4f756ad5

SHA256
796b1e3946b125ca038c01e01734611bd5a0a2f43ab70af25204e13c98e497ee

SHA512
fa74de095c9a71e9706d5506ba84d7a1c387a5b3ce308bc77d391e662f5e05fbb1f38270400bb32fed3e9e690cf7096e1b76bc1ea5dc9bee58f067977c5e7229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
035abe57fa282277a8c441cd6dac63f8

SHA1
4fcc776cb455bf3796e02400a85936b264474a18

SHA256
3c51609c860918d0b29a0d2c7e6ed028ebf1a65ec985f46bfbb0d6c0c401badb

SHA512
fbe9fc8e1adda6edde0619e0b7c95c53fdd1541d3736048c31bbad5036086245124c46b456147fbd8e445675eb02f9c7c623eb7f2bc34995dcdf9a790b554990

Download Submit